test(e2e): migrate test-runtime-overrides.sh to vitest

.github/workflows/e2e-vitest-scenarios.yaml

@@ -40,7 +40,7 @@ jobs:
           SCENARIOS: ${{ inputs.scenarios }}
         run: |
           set -euo pipefail
-          allowed_jobs="openshell-version-pin-vitest,onboard-negative-paths-vitest,token-rotation-vitest,openclaw-tui-chat-correlation-vitest,gateway-guard-recovery"
+          allowed_jobs="openshell-version-pin-vitest,onboard-negative-paths-vitest,runtime-overrides-vitest,token-rotation-vitest,openclaw-tui-chat-correlation-vitest,gateway-guard-recovery"
           if [ -n "${JOBS}" ] && [ -n "${SCENARIOS}" ]; then
             echo "::error::Use either scenarios or jobs, not both." >&2
             exit 1
@@ -303,6 +303,45 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+  runtime-overrides-vitest:
+    needs: validate-jobs
+    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',runtime-overrides-vitest,') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/runtime-overrides
+      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install root dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run runtime overrides live test
+        # Migrated from test/e2e/test-runtime-overrides.sh. Builds the real
+        # sandbox image and exercises the runtime ENTRYPOINT override boundary.
+        run: |
+          set -euo pipefail
+          npx vitest run --project e2e-scenarios-live             test/e2e-scenario/live/runtime-overrides.test.ts             --silent=false --reporter=default
+
+      - name: Upload runtime overrides artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-vitest-scenarios-runtime-overrides
+          path: e2e-artifacts/vitest/runtime-overrides/
+          include-hidden-files: false
+          if-no-files-found: ignore
+          retention-days: 14
+
   token-rotation-vitest:
     needs: validate-jobs
     if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',token-rotation-vitest,') }}
@@ -372,9 +411,7 @@ jobs:
           SLACK_APP_TOKEN_B: "xapp-fake-B-rotation-e2e"
         run: |
           set -euo pipefail
-          npx vitest run --project e2e-scenarios-live \
-            test/e2e-scenario/live/token-rotation.test.ts \
-            --silent=false --reporter=default
+          npx vitest run --project e2e-scenarios-live             test/e2e-scenario/live/token-rotation.test.ts             --silent=false --reporter=default
 
       - name: Upload token rotation artifacts
         if: always()
@@ -569,6 +606,7 @@ jobs:
         live-scenarios,
         openshell-version-pin-vitest,
         onboard-negative-paths-vitest,
+        runtime-overrides-vitest,
         token-rotation-vitest,
         openclaw-tui-chat-correlation-vitest,
         gateway-guard-recovery,